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On Page 3, fc^tween lines 8 and 9, please ins 
the following: 

SUMMARY OF THE INVENTION 

On Page 33, please delete line 12 and replace 
with the following: 



BRIEF DESCRIPTION OF THE DRAWINGS 



FIGS. 1A-1D, 2A, 2B, 3A and 3B are graphs useful 
in explaining the present invention. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 



IN THE CLAIMS 



1. (Amended) Method designed to prove to a controller 
entity, 

- the authenticity of an entity and/or 

- the integrity of a message M associated with 
this entity, 

by means of all or part of the following 
• , parameters or derivatives of these parameters: 

• T 



Urn ' ' - m pairs of private values Qi, Q 2 , ... Q m and 

public values 61,02, ... G m (m being greater than or 
equal to 1) , 

- a public modulus n constituted by the product of 
f prime factors pi, p 2 , ... Pf (f being greater than or 
equal to 2) , 

the said modulus and the said private and public 
values being related by relations of the following type 
Gi.Qi V = 1. mod n or Gi. = Qi v . mod n 
where v denotes a public exponent of the form: 
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where k is a security parameter greater than 1; 

2 

the said m public values Gi being squares gi of m 
distinct base numbers gi, g2 , ... gtrw smaller than the f 
prime factors pi, P2/ -» Pm| ; 

the said pi, P2 / -» Pm prime factors and/or the 
said m base numbers gi, g2 , .... gm being produced such 
that the following conditions are satisfied: 
First condition 

each of the equations: 

2 

x v = gi mod n 
can be resolved in x in the ring of integers 
modulo n; 
Second condition 

if Gi = Qi V mod n, among the m numbers qi obtained 
by taking Qi squared modulo n, k-1 times, one of them 
is not equal to ^i (in other words is not trivial) , 

if Gi.Qi V = 1 mod n, among the m numbers qi 
obtained by taking the inverse of Qi modulo n squared 
modulo n, k-1 times, one of them is not equal to -Kji 
(in other words is not trivial) ; 
Third condition 

at least one of the 2m equations 

x 2 = gimod n 

x 2 = -gimod n 
can be resolved in x in the ring of integers 
modulo n; 




the said method implements, in the following 
steps, an entity called a witness having f prime 
factors pi and/or m numbers of base gi and/or 
parameters of the Chinese remainders of the prime 
factors and/or the public modulus n and/or the m 
private values Qi and/or the f.m components Qi,j (Qi,j 

s Qi mod p j ) of the private values Qi and of the public 
exponent v; 

- the witness computes commitments R in the ring 
of integers modulo n; each commitment being computed: 

. either by performing operations of the type: 

R = r v mod n 
where r is a random value such that 0 < r < n, 
. or 

. . by performing operations of the type 
Ri =ri v mod pi 
where ri is a random value associated with the 
prime number Pi such that 0<ri<Pi / each ri belonging to 
a collection of random values {r lt r 2 , . . . r f } 

. . then by applying the Chinese remainders method, 

- the witness receives one or more challenges d; 
each challenge d comprising m integers di hereinafter 
called elementary challenges; the witness, on the basis 
of each challenge d, computes a response D by 
performing operations of the type: 

D ^ r. Ql dl .Q 2 d2 ... Q m dm mod n 

. or 

. . * by performing operations of the type: 

t-n. _ r\. dl ^ , d2 ^ dm , 
Di m ri.Qi,i .Qi,2 .« Qi # m mod Pi 
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. . then by applying the Chinese remainders 

method; 

the said method being such that there are as many 
responses D as there are challenges d as there are 
commitments R, each group of numbers R, d, D forming a 
triplet referenced {R,d,D}. 

2. (Amended) Method according to claim 1, designed to 
prove the authenticity of an entity known as a 
demonstrator to an entity known as the controller, the 
said demonstrator entity comprising the witness; 
the said demonstrator and controller entities executing 
the following steps: 

• Step 1: act of commitment R 

at each call, the witness computes each 
commitment R by applying the process specified 
according to claim 1, 

- the demonstrator sends the controller all or 
part of each commitment R, 

. Step 2: act of challenge d 

- the controller, after having received all or 
part of each commitment R, produces challenges d whose 
number is equal to the number of commitments R and 
sends the challenges d to the demonstrator, 

. Step 3 : act of response D 

- the witness computes the responses D from the 
challenges d by applying the process specified 
according to claim 1, 

. Step 4: act of checking 

- the demonstrator sends each response D to the 
controller, 



case where the demonstrator has transmitted a part 
of each commitment R if the demonstrator has 
transmitted a part of each commitment R, the 
controller, having the m public values G]_, G 2 .../ Gxn, 
computes a reconstructed commitment R f , from each 
challenge d and each response D, this reconstructed 
commitment R' satisfying a relationship of the type: 

R' = Gi dl .G 2 d2 . ... Gm dm . D v mod n 
or a relationship of the type 

R' = D v /Gi dl .G 2 d2 . ... G m dm . mod n 
the controller ascertains that each reconstructed 
commitment R' reproduces all or part of each commitment 
R that has been transmitted to it, 

case where the demonstrator has transmitted the 
totality of each commitment R 

if the demonstrator has transmitted the totality 

of each commitment R, the controller, having the m 

public values Gi, G2,... G™, ascertains that each 

commitment R satisfies a relationship of the type 

„ , _ dl ~ d2 ^ dm „v , 
R 1 = Gl .G2 . ... G m . D mod n 

or a relationship of the type 

R's D v /Gi dl .G 2 d2 . ... G m dm . mod n. 



Claims 3 and 4 are not changed. 

5. (Amended) Method according to claim 4, designed to 
prove the authenticity of the message M by checking the 
signed message through an entity called a controller; 
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Checking operation 

the said controller entity having the signed 
message executes a checking operation by proceeding as 
follows : 

case where the controller has commitments R, 
challenges d, responses D, 

if the controller has commitments R, challenges d, 
responses D, 

. . the controller ascertains that the commitments 
R, the challenges d and the responses D satisfy 
relationships of the type 

A R ^ Gl dl .G 2 d2 . ... G m dm . D V mod n 

or relationships of the type 

_ _v /_ dl ~ d2 ~ dm 

R = D /Gi .G2 . ... Gxn - mod n 

. . the controller ascertains that the message M, 
the challenges d and the commitments R satisfy the 
hashing function 

d = h (message, R) 
. case where the controller has challenges d 
and responses D 

if the controller has challenges d and 
responses D, 

. . the controller reconstructs, on the basis of 
each challenge d and response D, commitments R' 
satisfying relationships of the type: 

R< = Gl dl .G 2 d2 . ... G m dm . D V mod n 
or relationships of the type 

R»s D v /Gi dl .G 2 d2 . ... G m dm . mod n 
. . the controller ascertains that the message M 
and the challenges d satisfy the hashing function 
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d=h (message, R* ) 
. case where the controller has commitments R and 
responses D 

if the controller has commitments R and responses D, 

. the controller applies the hashing function 

and reconstructs d* 

d" = h (message, R) 

. . the controller ascertains that the commitments 

R, the challenges d' and the responses D satisfy 

relationships of the type: 

^ « dl o d2 ^ dm 

R = Gi .G2 . ... Gm . D mod n 

or relationships of the type 

„ _v , _ dl ~ d2 ~ dm 

R s D /G± .G2 . ... G m . mod n. 

6. (Amended) System designed to prove, to a 
controller server, 

- the authenticity of an entity and/or 

- the integrity of a message M associated with 
this entity, 

by means of all or part of the following 
parameters or derivatives of these parameters: 

- m pairs of private values Qi, Q 2/ ... Q m and 
public values Gi,G 2 , ... G m (m being greater than or 
equal to 1) , 

- a public modulus n constituted by the product of 
f prime factors pi, p 2/ ... Pf (f being greater than or 
equal to 2), 

the said modulus and the said private and public 
values being related by relations of the following 
type : 
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Gi.Qi v = 1. mod n or Gi = Qi v mod n; 
where v denotes a public exponent of the form: 

v = 2 k 

where k is a security parameter greater than 1; 

2 

the said m public values Gi being squares gi of m 
distinct base numbers gi, g2 , ... gm/ smaller than the f 
prime factors pi, P2/ ... Pf ; 

the said pi, P2 , ... Pf prime factors and/or the 
said m base numbers gi, g2 , ... gm being produced such 
that the following conditions are satisfied: 
First condition 

each of the equations: 

2 

x v s gj_ mod n 
can be resolved in x in the ring of integers 
modulo n; 
Second condition 

if Gi = Qi V mod n, among the m numbers qi obtained 
by taking Qi squared modulo n, k-1 times, one of them 
is not equal to +gi (in other words is not trivial) , 

if Gi.Qi V = 1 mod n, among the m numbers qi 

obtained by taking the inverse of Qi modulo n squared 

modulo n, k-1 times, one of them is not equal to +gi 

(in other words is not trivial) ; 
Third condition 

at least one of the 2m equations 

x 2 = gimod n 
x 2 = - gi mod n 
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can be resolved in x in the ring of integers 
modulo n; 

the said system comprises a witness device, 
contained especially in a nomad object which, for 
example, takes the form of a microprocessor-based bank 
card, 

the witness device comprises 

- a memory zone containing the f prime factors pi 
and/or the m numbers of bases gi and/or parameters of 
the Chinese remainders of the prime factors and/or the 
public modulus n and/or the m private values Qi and/or 

the f.m components Qi,j (Qi,j = Qi mod P j ) of the 
private values Qi and of the public exponent v; 
the said witness device also comprises: 

random value production means, hereinafter 
called random value production means of the witness 
device, 

- computation means, hereinafter called means for 
the computation of commitments R of the witness device, 
to compute commitments R in the ring of integers modulo 
n; each commitment being computed: 

• either by performing operations of the type: 

v -, 
Ri = r mod n 

where r is a random value produced by the random 
value production means, and r is such that 0 < r < n; 

• or by performing operations of the type: 

Ri = ri V mod pi 
where ri is a random value associated with the 
prime number pi such that 0 < ri < pi each ri belonging 
to a collection of random values {ri, r2 , . . - rf} 
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produced by random value production means, then by- 
applying the Chinese remainders method; 

the said witness device also comprises: 

- reception means hereinafter called the means for 
the reception of the challenges d of the witness 
device, to receive one or more challenges d; each 
challenge d comprising m integers di hereinafter called 
elementary challenges; 

- computation means, hereinafter called means for 
the computation of the responses D of the witness 
device for the computation, on the basis of each 
challenge d, of a response D, 

. either by performing operations of the type: 

„ _ dl . d2 ^ dm 

D s r.Qi .Q2 .... Qm m °d n 

. or by performing operations of the type: 

^ ^ . dl ^ . d2 _ , dm 

D = r.Qi,! .Qi,2 - Qi f m m °d pi 

and then by applying the Chinese remainders 
method, 

transmission means to transmit one or more 
commitments R and one or more responses D; 
there are as many responses D as there are challenges d 
as there are commitments R, each group of numbers R, d, 
D forming a triplet referenced {R,d,D}. 

7. (Amended) System according to claim 6, designed to 
prove the authenticity of an entity called a 
demonstrator and an entity called a controller, 
the said system being such that it comprises: 

a demonstrator device associated with the 
demonstrator entity, the said demonstrator device being 
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interconnected with the witness device by 
interconnection means and possibly taking the form 
especially of logic microcircuits in a nomad object, 
for example the form of a microprocessor in a 
microprocessor-based bank card, 

a controller device associated with the 
controller entity, the said controller device 
especially taking the form of a terminal or remote 
server, the said controller device comprising 
connection means for its electrical, electromagnetic, 
optical or acoustic connection, especially through a 
data-processing communications network, to the 
demonstrator device; 

the said system enabling the execution of the 
following steps: 

. Step 1: act of commitment R 
at each call, the means of computation for the 
commitments R of the witness device compute each 
commitment R by applying the process specified 
according to claim 1, 

the witness device has means of transmission, 
hereinafter called the transmission means of the 
witness device, to transmit all or part of each 
commitment R to the demonstrator device through the 
interconnection means, 

the demonstrator device also has transmission 
means, hereinafter called the transmission means of the 
demonstrator device, to transmit all or part of each 
commitment R to the controller device through the 
connection means; 

. Step 2: act of challenge d 
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the controller device comprises challenge 
production means for the production, after receiving 
all or part of each commitment R, of the challenges d 
equal in number to the number of commitments R, 

the controller device also has transmission means, 
hereinafter denoted transmission means of the 
controller, to transmit challenges d to the 
demonstrator through connection means, 

. Step 3: act of response D 

the means of reception of the challenges d of the 
witness device receive each challenge d coming from the 
demonstrator device through the interconnection means, 

the means of computation of the responses D of the 
witness device compute the responses D from the 
challenges d by applying the process specified 
according to claim 1, 

. Step 4: act of checking 
the transmission means of the demonstrator transmit 
each response D to the controller, 
the controller device also comprises: 

computation means, hereinafter called the 
computation means of the controller device, 

comparison means, hereinafter called the 
comparison means of the controller device, 
case where the demonstrator has transmitted a part of 
each commitment R 

if the transmission means of the demonstrator have 
transmitted a part of each commitment R, the 
computation means of the controller device, having m 
public values Gi, G2, -••/ Gm> compute a reconstructed 
commitment R' , from each challenge d and each response 
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D, this reconstructed commitment R' satisfying a 
relationship of the type: 

R 1 - Gi dl .G 2 d2 . ... Grn dm . D V mod n 
or a relationship of the type 

R'= D v /Gi dl .G 2 d2 . ... Gm dm . mod n 
the comparison means of the controller device 

compare each reconstructed commitment R' with all or 

part of each commitment R received, 

case where the controller has transmitted the 

totality of each commitment R 

if the transmission means of the demonstrator have 
transmitted the totality of each commitment R, the 
computation means and the comparison means of the 
controller device, having m public values G]_, G 2 , -.-/ 
G m ascertain that each commitment R satisfies a 
relationship of the type 

„ _ dl d2 ~ dm ^v , 
R = Gl . G 2 . ... G m . D mod n 

or a relationship of the type 

R - D V / Gl dl .G 2 d2 . ... G m dm . mod n. 

8. (Amended) System according to claim 6, designed to 
give proof to an entity known as a controller, of the 
integrity of a message M associated with an entity 
known as a demonstrator, 

the said system being such that it comprises 

a demonstrator device associated with the 
demonstrator entity, the said demonstrator device being 
interconnected with the witness device by 
interconnection means and possibly taking the form 
especially of logic microcircuits in a nomad object, 
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for example the form of a microprocessor in a 
microprocessor-based bank card, 



controller entity, the said controller device 
especially taking the form of a terminal or remote 
server, the said controller device comprising 
connection means for its electrical, electromagnetic, 
optical or acoustic connection, especially through a 
data processing communications network, to the 
demonstrator device; 

the said system enabling the execution of the 
following steps: 

. Step 1: act of commitment R 

at each call, the means of computation of the 
commitments R of the witness device compute each 
commitment R by applying the process specified 
according to claim 1, 

the witness device has transmission means, 
hereinafter called the transmission means of the 
witness device, to transmit all or part of each 
commitment R to the demonstrator device through the 
interconnection means, 

. Step 2: act of challenge d 

the demonstrator device comprises computation 
means, hereinafter called the computation means of the 
demonstrator, applying a hashing function h whose 
arguments are the message M and all or part of each 
commitment R to compute at least one token T, 

the demonstrator device also has transmission 
means, hereinafter known as the transmission means of 



a 



controller 



device 



associated 



with 



the 
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the demonstrator device, to transmit each token T 
through the connection means to the controller device, 
the controller device also has challenge production 
means for the production, after having received the 
token T, of the challenges d in a number equal to the 
number of commitments R, 

the controller device also has transmission means, 
hereinafter called the transmission means of the 
controller, to transmit the challenges d to the 
demonstrator through the connection means; 

. Step 3 : act of response D 

the means of reception of the challenges d of the 
witness device receive each challenge d coming from the 
demonstrator device through the interconnection means, 

the means of computation of the responses D of the 
witness device compute the responses D from the 
challenges d by applying the process specified 
according to claim 1, 

. Step 4: act of checking 

the transmission means of the demonstrator 
transmit each response D to the controller, 

the controller device also comprises computation 
means, hereinafter called the computation means of the 
controller device, having m public values Gi, G2 , - - . , 
G m/ in order to firstly compute a reconstructed 
commitment R', from each challenge d and each response 
D, this reconstructed commitment R 1 satisfying a 
relationship of the type: 



R< - Gi dl .G 2 d2 . ... G m dm D V mod n 



or a relationship of the type 
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R's D v /Gi .G 2 



d2 



dm 



mod n 



then, secondly, compute a token T f by applying the 
hashing function h having as arguments the message M 
and all or part or each reconstructed commitment R', 

the controller device also has comparison means, 
hereinafter known as the comparison means of the 
controller device, to compare the token T 1 with the 
received token T. 

Claim 9 is hot changed. 

10. (Amended) System according to claim 9, designed to 
prove the authenticity of the message M by checking the 
signed message by means of an entity called the 
controller; 
Checking operation 

the said system being such that it comprises a 
controller device associated with the controller 
entity, the said controller device especially taking 
the form of a terminal or remote server, the said 
controller device comprising connection means for its 
electrical, electromagnetic, optical or acoustic 
connection, especially through a data-processing 
communications network, to the signing device; 

the said signing device associated with the 
signing entity comprises transmission means, 
hereinafter known as the transmission means of the 
signing device, for the transmission, to the controller 
device, of the signed message through the connection 
means, in such a way that the controller device has a 
signed message comprising: 



- the message M, 

- the challenges d and/or the commitments R, 

- the responses D; 

the controller device comprises: 

computation means hereinafter called the 
computation means of the controller device, 

comparison means, hereinafter called the 
comparison means of the controller device; 

. case where the controller device has commitments 
R, challenges d, responses D 

if the controller has commitments R, challenges d, 
responses D, 

. the computation and comparison means of the 
controller device ascertain that the commitments R, the 
challenges d and the responses D satisfy relationships 
of the type 

R = Gi dl .G 2 d2 . ... Gm dm . D v mod n 
or a relationship of the type 

R = D v /Gi dl .G 2 d2 . ... G m dm . mod n 
. the computation and comparison means of the 
controller device ascertain that the message M, the 
challenges d and the commitments R satisfy the hashing 
function: 

d = h (message, R) 
. case where the controller device has challenges 
d and responses D 

if the controller device has challenges d and 
responses D, 

the computation means of the controller 
device, on the basis of each challenge d and each 
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response D, compute commitments R 1 satisfying 
relationships of the type: 

R ^ Gl dl .G 2 d2 . ... G m dm . D V mod n 
or a relationship of the type 

R ^ D v /Gi dl .G 2 d2 . ... G m dm . mod n 
. the computation and comparison means of the 
controller device ascertain that the message M and the 
challenges d satisfy the hashing function: 

d = h (message, R ' ) 
case where the controller device has commitments R 
and responses D 

if the controller device has commitments R and 
responses D, 

. . the computation means of the controller device 
apply the hashing function and compute d' such that 

d 1 = h (message, R) 

. . the computation and comparison means of the 
controller device ascertain that the commitments R, the 
challenges d 1 and the responses D satisfy relationships 
of the type : 

„ _ dl ^ d2 ^ dm ^v n 
R = Gl .G2 . ... G m . D mod n 

or a relationship of the type 

R = D v /Gi dl .G 2 d2 . ... G m dm . mod n. 

11. (Amended) Terminal device associated with an 
entity, taking the form especially of a nomad object, 
for example the form of a microprocessor in a 
microprocessor-based bank card, designed to prove to a 
controller device: 

- the authenticity of an entity and/or 
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- the integrity of a message M associated with 
this entity; 

by means of all or part of the following 
parameters or derivatives of these parameters: 

m pairs of private values Ch, Q 2 , ... Q m and public 
values Gi,G 2 , ... G m (m being greater than or equal to 



- a public modulus n constituted by the product of 
f prime factors pi, p 2/ ... Pf (f being greater than or 
equal to 2), 

the said modulus and the said private and public 
values being related by relations of the following type 
Gi.Qi V = 1 mod n or Gi = Qi V mod n; 
where v denotes a public exponent of the form: 

v - 2 k 

where k is a security parameter greater than 1: 

2 

the said m public values Gi being squares gi of m 
distinct base numbers gi, g2, ... gm/ smaller than the f 
prime factors pi, P2 / ... Pf; 

the said pi, p2 , ... Pf prime factors and/or the 
said m base numbers gi, g2, ... gm being produced such 
that the following conditions are satisfied: 
First condition 

each of the equations: 



can be resolved in x in the ring of integers 
modulo n 



1) , 



x v = gi mod n 




Second condition 

if Gi = Qi V mod n, among the m numbers qi obtained 
by taking Qi squared modulo n, k-1 times, one of them 
is not equal to ^i (in other words is not trivial) , 

if Gi.Qi V s l mod n, among the m numbers qi obtained by 

taking the inverse of Qi modulo n squared modulo n, k-1 

times, one of them is not equal to +gi (in other words 

is not trivial) ; 
Third condition 

at least one of the 2m equations 

x 2 = gimod n 

x 2 = - gi mod n 
can be resolved in x in the ring of integers 

modulo n; 

the said terminal device comprises a witness 
device comprising 

- a memory zone containing the f prime factors pi 
and/or the m numbers of bases gi and/or parameters of 
the Chinese remainders of the prime factors and/or the 
public modulus n and/or the m private values Qi and/or 
the f.m components Qi,j (Qi,j 55 Qi mod pj ) of the 
private values Qi and of the public exponent v; 

the said witness device also comprises: 

random value production means, hereinafter 
called random value production means of the witness 
device, 

- computation means, • hereinafter called means for 
the computation of commitments R of the witness device, 



to compute commitments R in the ring of integers modulo 
n; each commitment being computed: 

• either by performing operations of the 

type : 

R = r v mod n 

where r is a random value produced by the random 
value production means, and r is such that 0 < r < n. 

• or by performing operations of the type: 

v -, 
Ri = ri mod pi 

where ri is a random value associated with the 
prime number pi such that 0 < ri < pi each ri belonging 
to a collection of random values {ri, T2 , - - - rf} 
produced by random value production means, then by 
applying the Chinese remainders method; 

the said witness device also comprises: 

- reception means hereinafter called the means for 
the reception of the challenges d of the witness 
device, to receive one or more challenges d; each 
challenge d comprising m integers di hereinafter called 

elementary challenges; 

- computation means, hereinafter called means for 
the computation of the responses D of the witness 
device for the computation, on the basis of each 
challenge d, of a response D, 

. either by performing operations of the type: 

D = r. Ql dl .Q 2 d2 - ... Qm dm mod n 
. or by performing operations of the type: 

D = r.Qi,i dl .Qi f2 d2 . Qi,m dm mod Pi 
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and then by applying the Chinese remainders 
method. 

transmission means to transmit one or more 
commitments R and one or more responses D; 
there are as many responses D as there are challenges d 
as there are commitments R, each group of numbers R, d, 
D forming a triplet referenced {R, d, D} . 

Claims 12-14 are not changed. 

15. (Amended) Controller device especially taking the 
form of a terminal or remote server associated with a 
controller entity, designed to prove: 

- the authenticity or an entity and/or 

- the integrity of a message M associated with 
this entity. 

by means of all or part of the following 
parameters or derivatives of these parameters: 

- m pairs of public values Gx,G 2 , ... G m (m being 
greater than or equal to 1) , 

- a public modulus n constituted by the product of 
f prime factors pi, p 2/ ... Pf (f being greater than or 
equal to 2) , unknown to the controller device and the 
associated controller entity, 

the said modulus and the said private and public 

values being related by relations of the following type 

Gi . Qi v = 1 . mod n or Gi = Qi V mod n ; 

where v denotes a public exponent of the form: 

0 k 
v = 2 

where k is a security parameter greater than 1; 



where Qi is a private value, unknown to the 
controller device, associated with the public value Gi ; 

2 

the said m public values Gi being squares gi of m 
distinct base numbers gi, g2 , ... gnu smaller than the f 
prime factors pi, p2/ ... Pf ; 

the said pi, p2, ... pf prime factors and/or the 
said m base numbers gi, g2 , ... gm being produced such 
that the following conditions are satisfied: 
First condition 

each of the equations: 

2 

x v = gi mod n 
can be resolved in x in the ring of integers 
modulo n 
Second condition 

if Gi = Qi V mod n, among the m numbers qi obtained 
by taking Qi squared modulo n, k-1 times, one of them 
is not equal to ^i (in other words is not trivial) , 

if Gi.Qi V = 1 mod n, among the m numbers qi obtained by 
taking the inverse of Qi modulo n squared modulo n, k-1 
times, one of them is not equal to +gi (in other words 
is not trivial) ; 
Third condition 

at least one of the 2m equations 

x 2 = gimod n 

x 2 = - gi mod n 
can be resolved in x in the ring of integers 
modulo n. 
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16. (Amended) Controller device according to claim 15, 
designed to prove the authenticity of an entity called 
a demonstrator to an entity called a controller; 

the said controller device comprising connection 
means for its electrical, electromagnetic, optical or 
acoustic connection, especially through a data- 
processing communications network, to a demonstrator 
device associated with the demonstrator entity; 

the said controller device being used to execute 
the following steps: 

Steps 1 and 2; act of commitment R, act of 
challenge d 

the said controller device also has means for the 
reception of all or part of the commitments R coming 
from the demonstrator device through the connection 
means, 

the controller device has challenge production 
means for the production, after receiving all or part 
of each commitment R, of the challenges d in a number 
equal to the number of commitments R, each challenge d 
comprising m integers di hereinafter called elementary 
challenges, 

the controller device also has transmission means, 
hereinafter called transmission means of the 
controller, to transmit the challenges d to the 
demonstrator through the connection means; 

. Steps 3 and 4: act of response, act of checking 
the said controller device also comprises: 

- means for the reception of the responses D 
coming from the demonstrator device, through the 
connection means, 
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computation means, hereinafter called the 
computation means of the controller device, 

comparison means, hereinafter called the 
comparison means of the controller device, 

case where the demonstrator has transmitted a part 
of each commitment R 

if the reception means of the demonstrator have 

received a part of each commitment R, the computation 

means or the controller device, having m public values 

Gi, G2, .-./ G m compute a reconstructed commitment R', 

from each challenge d and each response D, this 

reconstructed commitment R' satisfying a relationship 

of the type : 

_ , dl ~ d2 ~ dm ^v , 

R 1 = Gi .G2 . ... G m . D mod n 

or a relationship of the type 

R'es D v /Gi dl .G 2 d2 . ... Gm dm . mod n 
the comparison means of the controller device 
compare each reconstructed commitment R 1 with all or 
part of each commitment R received, 

case where the demonstrator has transmitted the 
totality of each commitment R 

if the reception means of the controller device 
have received the totality of each commitment R, the 
computation means and the comparison means of the 
controller device, having m public values Gi, G2 , 
G m ascertain that each commitment R satisfies a 
relationship of the type: 

„ ~ dl ^ d2 „ dm _/v 

R = Gi .G2 . ... G m . D mod n 

or a relationship of the type 



R ^ D v /Gi .G 2 . ... Gm . mod n. 
Claim 17 is not changed. 

18. (Amended) Controller device according to claim 15, 
designed to prove the authenticity of the message M by 
checking a signed message by means of an entity called 
a signed message; 

the signed message sent by a signing device 
associated with a signing entity having a hashing 
function h (message, R) , comprising: 

- the message M, 

- the challenges d and/or the commitments R, 

- the response D; 
Checking operation 

the said controller device comprising connection 
means for its electrical, electromagnetic, optical or 
acoustic connection, especially through a data- 
processing communications network, to a signing device 
associated with the signing entity, the said controller 
device having received the signed message from the 
signing device, through the connection means, 

the controller device comprises: 

computation means, hereinafter called the 
computation means of the controller device, 

comparison means, hereinafter called the 
comparison means of the controller device; 

. case where the controller device has commitments 
R, challenges d, responses D 

if the controller has commitments R, challenges d, 
responses D, 
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. . the computation and comparison means of 

the controller device ascertain that the commitments R, 

the challenges d and the responses D satisfy 

relationships of the type 

^ ^ dl ^ d2 ^ dm , 
R = Gl .G2 . ... G m . D mod n 

or a relationship of the type 

R = D v /Gi dl .G 2 d2 . ... G m dm . mod n 
. the computation and comparison means of the 
controller device ascertain that the message M and the 
challenges d satisfy the hashing function 

d = h (message, R) 
. case where the controller device has commitments 
R and responses D 

if the controller device has commitments R and 
responses D, 

. . the computation means of the controller device 
apply the hashing function and compute d' such that 

d' = h (message, R 1 ) 
. the computation and comparison means of the 
controller device ascertain that the commitments R, the 
challenges d' and the responses D satisfy relationships 
of the type : 

R ^ Gl dl .G 2 d2 . - G m dm D V mod n 
or a relationship of the type 

R = D v /Gi dl .G 2 d2 . ... G m dm . mod n. 



